Inside ICMacOS: From an Infostealer to a Persistent RAT

ICMacOS is a commercial macOS infostealer/RAT sold as Malware-as-a-Service by an actor known as GlowComa and promoted on Russian-speaking cybercrime forums and Telegram. The malware is delivered via social-engineered ClickFix pages and a Bash dropper that captures the login password, fetches an architecture-specific Mach-O payload, and runs it with persistence (LaunchAgent) and an interactive WebSocket C2. It harvests a wide range of sensitive data — browser credentials and extensions, desktop crypto wallets, Apple Keychain items, messaging databases, developer/cloud secrets and terminal history — and exfiltrates archives to escapeai.live; Version 2 adds anti-duplication, elevated persistence, and an interactive shell, creating significant risk to developer and enterprise environments.